Smart Card Support - bomgar.com · Bomgar Remote Support Software, Remote Desktop Control, Smart...

Smart Card Support

© 2017 Bomgar Corporation. All rights reserved worldwide. BOMGAR and the BOMGAR logo are trademarks of Bomgar Corporation; other trademarks shown are the property of their respective owners. TC:1/11/2018

SMART CARD SUPPORT

Table of Contents

Smart Cards for Remote Authentication 3

Prerequisites 3

Install the Smart Card Driver 4

Install a Jump Client, Jumpoint, or Elevation Service for Elevated Session Start 5

Jumpoint Installation 5

Jump Client Installation 5

Elevation Service Installation 6

Use a Virtualized Smart Card 7

Use Case 1: Log Into the Remote Computer Using Smart Card Credentials 9

Use Case 2: Run As the Smart Card User 10

CONTACT BOMGAR [email protected] | 866.205.3650 (US) | +44 (0) 1628 480 210 (UK/EMEA) BOMGAR.COM 2© 2017 Bomgar Corporation. All rights reserved worldwide. BOMGAR and the BOMGAR logo are trademarks of Bomgar Corporation; other trademarks shown are the property of their respective owners. TC: 1/11/2018

Smart Cards for Remote AuthenticationDuring a support session, a support representative may need to operate with administrative rights in order to effectivelytroubleshoot the remote computer. Within environments where security implementations require smart card use for authentication,Bomgar enables the representative to pass administrative credentials to the remote computer from a smart card resident on therepresentative's local system.

PrerequisitesTo use Bomgar smart card support through a Jump Client, the following prerequisites must be met:

l The representative's computer must have a Bomgar virtual smart card driver installed.

l Each supported computer must have a Bomgar virtual smart card driver installed.

l Each supported computer must be running Windows Vista or above.

l Each supported computer must be accessible by a Bomgar Jump Client running in elevated mode.

Bomgar smart card support can be used with the Jump To functionality when the following prerequisites are met:



Bomgar smart card support can be used with customer-initaited sessions when the following prerequisites are met:


l Each supported computer must have a Bomgar virtual smart card driver installed.


l Each supported computer must have the Bomgar elevation service installed.


SMART CARD SUPPORT

Install the Smart Card Driver

1. Go to /login > My Account :: Bomgar Virtual Smart Card.2. Download the representative installation package and the

customer installation package for the appropriate versions ofWindows.

3. Install the representative virtual smart card driver.

l Distribute the representative driver installer to allrepresentatives within your support center who requireremote smart card functionality.

l The driver can be installed manually or via a softwaredeployment tool.

l Once the driver is installed, it creates a service: BomgarRepresentative Service.

4. Install the customer virtual smart card driver. (If Jump To is usedto access the remote system, the customer virtual smart carddriver does NOT have to be pre-installed.)

l Distribute the customer driver installer to all remotecomputers to which you will need to pass smart cardcredentials.

l The driver can be installed manually or via a softwaredeployment tool.

l Once the driver is installed, it creates a service: Bomgar Customer Service.


SMART CARD SUPPORT

Install a Jump Client, Jumpoint, or Elevation Service for Elevated Session StartWhen attempting to operate with the credentials on a smart card, the user is prompted to enter a PIN. This UAC prompt isinaccessible to the support representative if the Bomgar customer client is not already running in elevated mode. It is thereforenecessary to access the remote computer in one of three ways:

l A Jump Client running as a system service

l A Jumpoint or local network Jump, using administrative credentials

l A customer-initiated or Jump session with the Bomgar elevation service pre-installed on the remote system

Accessing the remote computer in elevated mode allows the representative to interact with UAC prompts in order to enter the smartcard PIN.

When attempting to operate with the credentials on a smart card, the user is prompted to enter a PIN. This UAC prompt isinaccessible to the support representative if the Bomgar customer client is not already running in elevated mode. It is thereforenecessary to access the remote computer via a pre-installed Jump Client, which must be running as a system service, or through aJumpoint or local network Jump using administrative credentials. Jumping to a remote computer via an elevated Jump allows therepresentative to interact with UAC prompts in order to enter the smart card PIN.

Jumpoint Installation

To install a Jumpoint, see Jumpoint: Set Up Unattended Access to a Network. No special setup is required.

Jump Client Installation

To install a Jump Client in preparation for using smart card support, you must set certain options as described below.

1. From the /login interface of your Bomgar Appliance, go to Jump> Jump Clients.

2. Configure the Jump Client settings as needed. For details, seethe Jump Clients: Manage Settings and Install Jump Clients forUnattended Access.

l The connection type can be either active or passive.

l Be sure to check Attempt an Elevated Install if theClient Supports It as well as Prompt for ElevationCredentials if Needed.

3. Click Create.

4. From this page, you may email the Jump Client installer to oneor more remote users.

5. Alternatively, select a platform and download the Jump Clientinstaller to your local system. You may then distribute thisinstaller to multiple systems for manual installation, or you maydistribute it via a software deployment tool.


SMART CARD SUPPORT

https://www.bomgar.com/docs/remote-support/getting-started/admin/index.htm

https://www.bomgar.com/docs/remote-support/getting-started/admin/jump-clients.htm

https://www.bomgar.com/docs/remote-support/getting-started/admin/jump-clients.htm

Elevation Service Installation

In special cases, you may need a session to start with the customerclient already in elevated mode, or you may need to elevate thecustomer client without providing credentials. To securely elevate thecustomer client without the prompt, download the Bomgar AutomaticElevation Service and install it beforehand on the remote Windowssystems to which you need credential-less elevation access. You mustinstall the elevation service using an account that has administrativeprivileges to the local machine.

When the elevation service runs, it adds to the registry a hash unique to your Bomgar site. Then, when the remote system begins asession through that site, the elevation service matches the registry hash against the hash in the client. If they match, the clientattempts automatic elevation.

Elevation occurs following the rules set in /login > Public Portals > Customer Client :: Miscellaneous Options. If the rules set forthe customer client do not allow it to elevate automatically, a matching hash will still make the elevation service the means forelevation when the representative clicks the Elevate button in the representative console. When the elevation service is used,neither the representative nor the customer is prompted for credentials.

After a Bomgar software update, your site hash changes. Download and run the elevation service registry file to update the registryhash on systems which already have the elevation service installed. You must run the elevation service registry file using anaccount that has administrative privileges to the local machine.


SMART CARD SUPPORT

Use a Virtualized Smart CardTo use smart card credentials on a remote system, you must Jump to that system, or you must start a customer-initiated session witha system that has the Bomgar elevation service pre-installed.

If using a Jump Client, the Jump Client must be running in service mode, or the remote system must also have the elevation servicepre-installed with its service running. The appropriate virtual smart card drivers must be installed on both your local system and theremote system, with their services running.

Alternatively, a system can be accessed using the Jump To functionality from within the representative console. Using the Jump Tofunctionality does not require the virtual smart card driver to be pre-installed on the customer's system. In this scenario, Bomgarinstalls the driver as part of the Jump to the end system being accessed.

Note: The customer smart card driver is ONLY installed during a Jump To push when the representative performing the Jumphas the representative smart card driver installed on their local system.

If using a customer-initiated session, the elevation service must be pre-installed on the remote computer, and its service must berunning. Also, the appropriate virtual smart card drivers must be installed on both your local system and the remote system, withtheir services running.

Begin a screen sharing session, and then click the Smart Card buttonto access a dropdown of available smart card readers on your system.1

Select the reader you would like to share with the remote computer.Once the reader has been virtualized on the remote system, amessage indicating that you have shared this reader is logged in thechat window. The smart card in the selected reader is now available touse on the remote computer, just as if it were physically present on the system being supported.

The smart card dropdown menu displays the name(s) of the available smart card readers and smart cards, along with an iconindicating the availability of each card reader or presence of each card:

l Black icon - Card not presentl Blue icon - Card presentl Gray icon - Reader and card not available

Once you have shared a reader, it remains selected and available for use throughout the session, as long as you do not log out thecurrent user. If you do log out the current user on the remote computer, the shared reader is deselected and must be re-selected ifyou need it later in the session.

When screen sharing, use a virtual smart card to perform administrative actions. You can run programs in another user context, oreven log in as a different user.

Also, if the virtual smart card feature is available in a session which is not elevated and a smart card reader has been shared intothe session, then certificates stored on the inserted smart card can be selected and used for elevation.

Note: Elevation performed using this feature takes slightly longer due to the extra transactions required to the virtual smart cardreader.

1If the smart card button does not appear in the screen sharing tool bar, make sure the representative smart card service is runningon your local computer. If the smart card button is present but disabled, make sure the customer smart card service is running onthe remote computer.


SMART CARD SUPPORT

Note: A smart card reader can be attached to only one active session at a time. From the Smart Card dropdown, you candeselect a virtualized reader to free it for use in another session.


SMART CARD SUPPORT

Use Case 1:Log Into the Remote Computer Using Smart Card CredentialsAfter Jumping to a remote computer, you may find that the computer is locked. Alternatively, you may need to perform administrativefunctions not permitted in the current user context.

Go to the remote login screen, logging out the current user ifnecessary. Click the Smart Card button and select a smart card readerto virtualize on the remote system. The smart card will now appear as auser login option.

Click the smart card user, enter the PIN, and log in.


SMART CARD SUPPORT

Use Case 2:Run As the Smart Card UserWhile supporting a remote computer, you may need to run a specificapplication with privileges not available in the current user context.Within a screen sharing session, click the Smart Card button andselect a smart card reader to virtualize on the remote system. Rightclick the desired application and choose Run As. From the UACprompt that appears, select the smart card and enter the PIN to run theapplication in the smart card user context.

Note: Smart card credentials cannot be used to run elevated tasksfrom the Special Actions menu.


SMART CARD SUPPORT

Smart Card Support - bomgar.com · Bomgar Remote Support Software, Remote Desktop Control, Smart...

Documents

Transcript of Smart Card Support - bomgar.com · Bomgar Remote Support Software, Remote Desktop Control, Smart...